Mailman 3 SaaS

How to fight spam registrations?

If the Mailman server’s admin starts receiving email bounces including text like the following, it means you are under a Postorius SPAM registration attack:

Hello from lists.domain.tld!

You're receiving this email because user <random_chars> has given your email address to register an account on lists.domain.tld.

To confirm this is correct, go to https://lists.domain.tld/accounts/confirm-email/<random_chars>/

In this article, we will consider available options to prevent those SPAM registrations.

⚠️ This isn’t relevant to stock Mailman code because it relies on custom Mailman3.com features.

Why is the attack possible?

The attack uses the public sign-up feature of Mailman’s web UI - Postorius. This workflow is enabled by default because subscribing to the mailing list does not automatically create a web user, in line with modern security best practices.

While in the old Mailman version 2, passwords were frivolously transferred by email in plain text, this is no longer possible in version 3, so users are required to sign up and maintain their passwords without putting them at risk.

This means that the sign-up in Postorius should usually be open, unless the SSO option is enabled and users sign up using their external accounts.

How can we mitigate the issue?

Mailman3.com is already implementing reasonable anti-spam measures on the sign-up pages of all servers, e.g., we restrict visitors from Tor exit nodes, which were identified as frequent spammers.

However, this can’t completely eliminate spam registrations, and we offer another option to fight them: CAPTCHA. Google reCAPTCHA v3 protection can be enabled on the signup and password reset forms.

As Google explains, “reCAPTCHA v3 will never interrupt your users”, so they won’t solve a challenge to prove they are humans. Despite there being some concerns that it isn’t GDPR-compliant, Google insists it is.

Feel free to reach out to support to enable CAPTCHA for your server.